[WOOT2021] Identifying Valuable Pointers in Heap Data

### Overview In this talk, James Roney presents research on enhancing memory cartography—a specialized data-oriented attack technique—to identify valuable pointers in heap memory without requiring heap spraying. In a standard memory cartography attack, an attacker with an arbitrary memory read vulnerability navigates through an application's address space along a pre-mapped network of pointers between memory regions (such as static data sections, heaps, and stacks) to leak arbitrary sensitive data without causing segmentation faults. While static data sections maintain deterministic relative layouts despite Address Space Layout Randomization (ASLR), transitioning from a dynamic, non-deterministic heap allocation to static data sections originally relied on heap spraying predictable objects. Roney and his collaborators introduce a method that uses signature-based byte filtering to reliably identify pointers from uncontrolled heap regions to static data sections.

### Key Topics - **Data-Oriented Attacks vs. Control-Flow Hijacking**: Unlike traditional control-flow hijacking attacks (e.g., overwriting return addresses) that trigger modern defenses such as stack canaries or Control Flow Integrity (CFI), data-oriented attacks manipulate program variables and data pointers while strictly adhering to legitimate control-flow paths. - **Memory Cartography Mechanics**: Originally introduced by Rogowski et al., memory cartography creates an offline map of deterministic pointers between memory regions. By chaining these references, an attacker can traverse from an initial leak to target data (such as browser session cookies) across fragmented memory spaces. - **Heap Non-Determinism Limitation**: Previous memory cartography required spraying known objects into the heap to bridge the gap between dynamic heap memory and static sections. In environments where the attacker cannot control heap allocations, this method fails. - **Signature-Based Pointer Identification**: An offline analysis technique that characterizes the byte patterns immediately surrounding frequent pointers to static destinations, generating simple byte-level filters that can identify target pointers during runtime heap scanning.

### Technical Details - **Offline Signature Compilation**: The attacker executes the target application locally multiple times across independent runs with ASLR enabled. By inspecting boundaries (e.g., via Linux `/proc/self/maps`), the attacker tracks heap memory regions and maps all pointers referencing external targets (such as libc or program libraries). The method identifies the most frequently referenced destination offsets across runs. For each target destination, the algorithm inspects a window of bytes surrounding the pointers (preceding bytes, pointer bytes shifting due to ASLR, and trailing bytes) and establishes upper and lower bound value intervals for each position across all runs to construct a byte filter. - **Online Attack Execution**: At attack time, the attacker scans memory starting from their local heap read vulnerability and evaluates aligned pointer-sized regions against the pre-compiled byte bounds. Once a match is detected, the attacker extracts the pointer to the known static destination, anchoring their memory cartography navigation without crashing the process. - **Empirical Evaluation**: The approach was evaluated using 10-fold cross-validation across 10 memory dumps per target program: - *Vim*: Tested as a single-threaded baseline with a unified heap; identified pointers to top frequent destinations with over 99% precision. - *Firefox*: Characterized by complex, multi-VMA jemalloc heap chunks. By aggregating relevant jemalloc chunks matching the JavaScript heap, the filter identified pointers to `libxul` with high precision, maintaining strong performance even in the worst-case individual heap chunk. - *Apache with OpenSSL 1.0.1 (Heartbleed)*: Evaluated against a real-world read vulnerability scenario, demonstrating equally high precision.

### Takeaways - **Expanded Threat Surface**: Attackers can reliably locate entry points into static data structures from heap memory using passive signature matching, eliminating the prerequisite of heap spraying. - **Security Implications**: Highlights the critical need for strict process isolation and independent address spaces for mutually untrusted origins, as in-process mitigations and ASLR do not prevent data-oriented pointer mapping. - **Assumptions & Future Directions**: The technique relies on stability of inter-region offsets between local analysis environments and victim targets. Future work aims to evaluate complete end-to-end exploits under real-world timing and bandwidth constraints.